Dive Brief:

• There is no current evidence that a December attack by a state-linked threat actor targeting the U.S. Treasury Department workstations has impacted any other federal agency, the Cybersecurity and Infrastructure Security Agency said Monday. 
• CISA said it is working closely with officials at the Treasury Department and BeyondTrust to fully mitigate and understand the impact of the attack, which has been attributed to threat actors linked to China. BeyondTrust notified Treasury officials last month that a threat actor stole a key used to provide cloud-based remote technical support to end users at the department.
• Meanwhile, BeyondTrust said it is close to finishing a forensic investigation of attacks against a limited number of RemoteSupport SaaS customers who were targeted in the attack spree, in an updated blog post. The company said all SaaS instances have been fully patched and no additional attacks have been reported.

Dive Insight:

The investigations indicate any immediate threat appears to have been contained, however questions remain about how the attacks specifically took place and what the long-term impacts will be for federal agencies and other BeyondTrust customers.

BeyondTrust last month linked the December attacks against Remote Support SaaS customers to a compromised API key. The company immediately revoked the key, notified affected customers and suspended instances. 

Beyond Trust also pushed out a patch to all self-hosted instances. 

Treasury officials disclosed the attack on the agency workstations in a letter to the chair and ranking member of the Senate Committee on Banking, Housing and Urban Affairs. 

During an investigation with outside forensics experts, the company identified a critical command injection vulnerability, listed as CVE-2024-12356, and a medium-severity vulnerability, listed as CVE-2024-12686. CISA in December added CVE-2024-12356 to its known exploited vulnerabilities catalog. 

Neither BeyondTrust or federal officials have commented on whether the CVEs played a direct role in the attacks against the Treasury Department workstations. 

Researchers at Censys on Thursday said more than 8,600 instances of BeyondTrust Remote Support & Privileged Remote Access were exposed, but on Monday updated the blog indicating more than 13,500 were exposed after modifying its detection methods.  

A spokesperson for BeyondTrust emphasized the instances are visible, but that does not mean they are vulnerable. The spokesperson noted that all SaaS instances have been fully patched against the CVEs in the advisory and that patches have been pushed to all self-hosted instances.

Censys last week cautioned that all exposed instances were not necessarily vulnerable. The company on Monday told Cybersecurity Dive that customers using these particular products should manually check their devices to make sure they were accurately patched as they are visible on the public internet, including by threat actors.